MTrackWeb/Roo.php

[web.mtrack] / MTrackWeb / Roo.php

diff --git a/MTrackWeb/Roo.php b/MTrackWeb/Roo.php
index b2d3c88..df4a86b 100644 (file)
--- a/MTrackWeb/Roo.php
+++ b/MTrackWeb/Roo.php
@@ -17,10 +17,15 @@ class MTrackWeb_Roo extends Pman_Roo
 {
     var $validTables = array(
         'mtrack_ticket', /// all of these MUST have applyFilters, and check authenication..
+        'Mtrack_ticket', /// all of these MUST have applyFilters, and check authenication..
         'mtrack_change',
         'core_enum',
         'Person',
         'mtrack_milestone',
+        'Projects',
+        'Images',
+        'mtrack_repos'
+        
     );
     
     function getAuth() {
@@ -34,30 +39,62 @@ class MTrackWeb_Roo extends Pman_Roo
         return true;
     }
     
-    function get($tbl)
+    function delete()
     {
+        $this->jerr("Delete not permitted yet...");
+        // only post requests..???
+        // need perms sorting out first.
+    }
+    
+    function checkPerm($obj, $lvl, $req=null)
+    {
+        if ($this->authUser) {
+            $res = parent::checkPerm($obj,$lvl,$req);
+            
+            if ($res) {
+                return $res;
+            }
+        }
+        // not authenticated...
+         
+        // these checks only apply to non-company users.
         
-        if (!in_array($tbl,$this->validTables)) {
-            $this->jerr("Invalid url");
+        // normally allowed, but we have more restrictions...
+        switch($obj->tablename()) {
+            
+            case 'core_enum':
+                if (empty($req['etype'])) {
+                    return false;
+                }
+                if ($lvl != 'S') {
+                    return false;
+                }
+                var_dump($req['etype']);
+                switch ($req['etype']) {
+                   // case 'severity':
+                    case 'classification':
+                    case 'severity':
+                    case 'resolution':
+                    case 'priority':
+                    case 'ticketstate':                    
+                     
+                    
+                    // not a member of the company..
+                    // not allowed in..
+                        return true;
+                    default:
+                        return false;
+                }
+                break; // should not get here...
+            
+            default:
+                return false;
+                
+            
+            
         }
         
-       
         
-        return parent::get($tbl);
-    }
-    function post($tbl)
-    {
         
-        if (!in_array($tbl,$this->validTables)) {
-            $this->jerr("Invalid url");
-        }
-        return parent::post($tbl);
-    
     }
-    function delete()
-    {
-        // only post requests..???
-        // need perms sorting out first.
-    }
-    
-}
\ No newline at end of file
+}